Alcasar 2.9 Exploitation

Security of Information and Communication Systems

USER MANUAL

This document describes how to administer ALCASAR with the ALCASAR Control Center (ACC) or by usingLinux command lines.

Project : ALCASAR Author : Rexy and 3abtux with support of ALCASAR Team . Thanksto the main translator (Clment).

Object : User manual Version : 2.9

Keywords : captive portal, access control, accountability, traceability, authentication Date : 2015 March

User manual ALCASAR 2.9 1/37

Table of contents 1.Introduction.........................................................................................................................................................3 2.Network settings..................................................................................................................................................4

2.1.ALCASAR settings...................................................................................................................................................5 2.2.Client devices settings...............................................................................................................................................5

3.Managing users and their devices........................................................................................................................7 3.1.Network activity.......................................................................................................................................................7 3.2.Creating groups.........................................................................................................................................................8 3.3.Editing and removing a group...................................................................................................................................9 3.4.Creating users...........................................................................................................................................................9 3.5.Searching and editing users.....................................................................................................................................10 3.6.Importing users.......................................................................................................................................................11 3.7.Emptying the user database.....................................................................................................................................11 3.8.Authentication exceptions.......................................................................................................................................11 3.9.Auto-registration via SMS......................................................................................................................................12

4.Filtering.............................................................................................................................................................15 4.1.Blacklist and whitelist.............................................................................................................................................15 4.2.Protocol filtering.....................................................................................................................................................16

5.Access to Statistics............................................................................................................................................17 5.1.Number of connections per user per day.................................................................................................................17 5.2.Connection status of users.......................................................................................................................................17 5.3.Daily use.................................................................................................................................................................18 5.4.Global and detailed traffic.......................................................................................................................................18 5.5.Security Report.......................................................................................................................................................20

6.Backup...............................................................................................................................................................20 6.1.Connection logs......................................................................................................................................................20 6.2.The users database..................................................................................................................................................21

7.Advanced features.............................................................................................................................................21 7.1.Administration accounts management....................................................................................................................21 7.2.Secure administration across the Internet................................................................................................................21 7.3.How to display your logo ?.....................................................................................................................................24 7.4.Server certificate.....................................................................................................................................................24 7.5.Use of an external directory server (LDAP or AD).................................................................................................25 7.6.Integration in a complex architecture (AD, external DHCP, LDAP).......................................................................26 7.7.Encryption of log files.............................................................................................................................................27 7.8.Managing multiple Internet connections (load balancing)......................................................................................28 7.9.Creating an ALCASAR dedicated PC.....................................................................................................................28 7.10.Bypassing the portal..............................................................................................................................................28

8.Shutdown, restart, update and reinstallation......................................................................................................29 8.1.Shutdown and restart...............................................................................................................................................29 8.2.Operating system update.........................................................................................................................................29 8.3.ALCASAR minor updates......................................................................................................................................29 8.4.ALCASAR major update or reinstallation..............................................................................................................29

9.Troubleshooting.................................................................................................................................................30 9.1.Network connectivity..............................................................................................................................................30 9.2.Available disk space................................................................................................................................................30 9.3.ALCASAR server services.....................................................................................................................................30 9.4.Client devices connection.......................................................................................................................................30 9.5.Connection to ALCASAR with a serial terminal....................................................................................................31 9.6.Problems experienced.............................................................................................................................................32

10.Security............................................................................................................................................................33 10.1.On ALCASAR......................................................................................................................................................33 10.2.On the network......................................................................................................................................................33

11.Annexes...........................................................................................................................................................35 11.1.Useful commands and files...................................................................................................................................35 11.2.Helpful authentication exceptions.........................................................................................................................36 11.3.User sheet..............................................................................................................................................................37


1. IntroductionALCASAR is a free and open-source Network Access Controler (NAC). This paper describes how to use it andhow to administer it.

The following screenshot is displayed for users attempting to access an HTTP website. This page is availablein English, Spanish, German, Dutch, French and Portuguese depending on the browsers settings. As long as theuser is not logged in, no traffic will pass through ALCASAR.

The homepage of the portal is available for any browser connected onthe network. The URL is http://alcasar (or http://alcasar.localdomain).From there, users can log on, log out, change their password and installthe security certificate into their web browsers.Administrators can access the graphical ALCASAR Control Center(A.C.C) by clicking the little notched wheel at the bottom right of thepage (or via https://alcasar.localdomain/acc).

This ACC is available in two languages (English and French) via an encrypted flow (HTTPS). Anauthentication is required with a login name in one of the three following profiles (cf. 7.1) :

profile admin can use all the administration functions ; profile manager is limited to user management functions ; profile backup is limited to a backup (of the log files) function.


Warning: The intrusion detection system of ALCASAR will forbid new connection attempts during 3 if it detects three connection failures on ACC.

2. Network settings

On the ALCASAR network, devices can be connected with multiple technologies (wired Ethernet, WiFi, PCL,etc.). For all these devices, ALCASAR is the DNS, the time server and the default gateway.

CAUTION : On the consultation network, no other gateway should be present (verify the PLCand WIFI Access Point settings).

The IP address setting of the network is defined during the installation process of the portal.

For example, with a class C network (default configuration) Network IP Address : 192.168.182.0/24 (sub-net mask : 255.255.255.0) ; Max number of devices : 253 ; ALCASAR eth1 IP address : 192.168.182.1/24 ; Parameters of connected devices :

available IP addresses : between 192.168.182.3 and 192.168.182.254 (static or dynamic) ; DNS server address : 192.168.182.1 (ALCASAR IP address) ; DNS suffix : localdomain (this DNS suffix must be set in the static address setting of the client device) ; Default gateway IP address : 192.168.182.1 (ALCASAR IP address) ; network mask : 255.255.255.0


ALCASAR network

WIFI Access Point(No routing functions)(No DHCP function)

ISP broadband modems/routers

PLC adapter

Switch

Multi-WANswitch or router.This optional equipment balances the network load on several

ISP Broadband modem/router (load balancing).

Internet

PLC

ALCASAR

WIFI repeter

Internet

2.1. ALCASAR settingsYou can change ALCASAR network settings in the system + network menu.

a) IP configuration

Currently, these parameters cannot be modified directly with the ACC. Nevertheless, you can change them in atext console by editing the file /usr/local/etc/alcasar.conf . When modifications are made, apply them with thecommand line alcasar-conf.sh --apply .

b) DHCP server

The DHCP (Dynamic Host Control Protocol) server provides IP settings to client devices connected on thenetwork.You can reserve IP addresses for devices that need static IP addresses (servers, printers, WiFi AccessPoint).Be sure that no other DHCP server is connected on your network. Or be sure to well knowing how managemulti-DHCP service (cf. 8.5a to manage the cohabitation with a A.D. server).

2.2. Client devices settings

a) Client device settingA User sheet is available at the end of this manual.Users only need a system in DHCP mode and a browser supporting JavaScript and pop-up windows.To be intercepted by ALCASAR, browsers must try to access a HTTP (and only HTTP) website. The proxyserver settings must be disabled.

b) Adding bookmarkOn browsers, it can be useful to add ALCASAR homepage (http://alcasar) to bookmarks in order to allow usersto change their password, to log out or to install the ALCASAR security certificate.


c) Installing the ALCASAR security certificateSome communications between client devices and ALCASAR are encrypted with SSL (Secure Socket Layer)protocol. This protocol needs two certificates created during the installation: the ALCASAR certificate and thelocal Certification Authority (C.A.) certificate. By default, browsers don't know this certification authority. So,one of the following page is displayed when they connect to the portal for the first time.

Mozilla-Firefox Microsoft-I.E. Google-chrome

Although it is possible to continue to browse, it is recommended to install thesecurity certificate of this C.A. in browsers so that they don't display thesepages anymore1. To do that, click the zone Install ALCASAR ACcertificate of the ALCASAR homepage. For each browser, follow thefollowing steps :

Mozilla-Firefox Konqueror

Internet Explorer 8 and Safari

Google chrome : Google Chrome saves the certificate locally ( certificat_alcasar_ca.crt ). Select preferences in the configuration menu, then advanced options , then manage certificates and then import in the tab Authorities .

1 You can avoid this manipulation either in buying and including in ALCASAR an official certificate which is known by all webbrowsers (see 8.4), or in disabling the encryption of authenticating flow with the script alcasar-https.sh {--on|--off} . Disabling theencryption means that you perfectly manage your ALCASAR network (see 11).


Select Trust this CA to identify websites.

1 click open 2 click authorize 3 click install the certificate

4 Choose the store Trusted root certification authorities

Select: Open in Kleopatra.

d) Network configuration in static mode (servers, printers, WIFI access points, etc.) :For these devices, the required parameters are the following :

default gateway : IP address of the eth1 network interface of ALCASAR ; DNS server : IP address of the eth1 network interface of ALCASAR ; DNS suffix : localdomain

Windows Seven Mandriva & Mageia Linux

e) Time synchronizationALCASAR includes a network time server ( NTP protocol) allowing you to synchronize devices connectedto the ALCASAR network. Thus, on Windows oron Linux, you can define ALCASAR server asthe time server by right clicking on the clock ofthe desktop. Enter alcasar on Linux and alcasar.localdomain on Windows.

Note : All NTP flows from consultationnetwork are redirected to ALCASAR.

3. Managing users and their devicesUser management interface is available in the menu AUTHENTICATION ).You can :

display the network activity. Disconnect a user. create, search, modify and remove a user or user group ; import user names from a text file or from a user database backup ; empty the user database ; define trusted client devices allowed to connect to the Internet without

authentication (exceptions).

3.1. Network activity


A connected user device. You can log out him or click on his name to view his profile

Device allowed to browse the Internet without authentication on ALCASAR

(trusted device- see 4.7.c)

Device connected on the ALCASAR network but with no user authenticated. You can remove this record (disassociate). It is

required if you want to change the device's static IP address or when a client device has a wrong IP address.

3.2. Creating groupsGenerally, in order to minimize the administration load, it's interesting to manage user group instead of eachuser. For that, the first thing to do is to define the list of user group to create.When you create a user group, you can define attributes of all the users of this group. These attributes are takeninto account only if they are not empty. Thus, let the attribute empty if you don't want to use it. For assistance,click on the attribute name.


The name is case sensitive (group1 and Group1 are two different names) and can't contain any accents or special characters.

Limit of timeWhen one of these limits is reached, the user is logged out.

For assistance, click on the attributes name.

Authorized periods in a weekExamplefor a period from Monday at 7 am to Friday at 6 pm :

Mo-Fr0700-1800

Expiry dateAfter this date, users of this group can't log in anymore. A week after this date, users will be automatically deleted.

Click on the zone to see a calendar.

Number of concurrent session per userExamples: 1 = only one session at a time, empty = no limit, X = X authorized concurrent sessions, 0 = account locked.Note : It's a good way to temporarily lock or unlock a user account

5 quality of service parameters (QOS)You can set limitations.

Data volume limit is set for one session. When the limit value is reached, the user is logged out.

URL redirectionOnce authenticated, the user is redirected to this URL.The URL must contain the protocol name. Example:

http://www.site.org

Maximum time of connectionThis time of connection is independent from the number of sessions. Thus, the

user can spend this time as he wants (in one or more sessions).

FilteringChoose the filtering policy. See 4 for more explanations about the

blacklist, whitelist and antivirus filtering system.

3.3. Editing and removing a group

3.4. Creating users

* When an attribute is defined both for user and for hisgroup (example : maximum time for a session), userattribute takes precedence over group attribute.* When a user is member of several groups, you can sethis primary group in the user attributes window (seenext ).* When an attribute prevents a user to log in, a messageis displayed in his login window (see user sheet atthe end of this manual).

Remark : if an expiration date is enabled, one week after this date, the user is automatically deleted. When auser is deleted from the database, his connections logs are kept in order to be able to impute his connections.


When the users are created, PDF vouchers are generated in the language of your choice.

If you choose a group, the user inherits its attributes*.

see the previous chapter to get details on attributes

Login and password are case sensitive(James and james are two different users)

To see/hide all attributes

If you create multiple users, it's interesting to fix an expiration date (see the remark below)

Click the name of the group to edit it

3.5. Searching and editing usersYou can search users with several criteria (login name, attributes, etc.). If you leave the criteria field blank, allusers will be listed.

The result is a list of users matching your search criteria. Each user's toolbar includes the following functions :


Deleting a user

Personal informationUser attibutes

Active sessions(From here, you can disconnect the user)

General information (connections list, statistics, password test, etc.)

Connections list(you can define an observation period)

3.6. Importing usersIn the ACC (menu AUTHENTICATION , Import ) :

a) From a user database backupWhen you import a user database backup, the current databasewill be emptied. Because this database needs to be provided incase of inquiry, a backup is automatically done (see 7 toretrieve this backup).

b) From a text file (.txt)This function allows you to easily add users to the current database. This text file must be formatted like this :one user login per line followed (or not) by a password separated by a space. Without a defined password,ALCASAR creates one randomly. This file can come from a spreadsheet application :

from the Microsoft office suite , record the file in Text (DOS) (*.txt) format ; from the LibreOffice office suite , record the file in Text CSV (.csv) format and remove

separators (option edit filter parameters ).Once the file is imported, ALCASAR creates each new account. If the login name already exists, the passwordis just changed. Two files in .txt and .pdf format, including login names and passwords, are created andsaved in the directory /tmp (during 24 hours). These files are available in the ACC.

3.7. Emptying the user databaseThis function allows you to delete all the users in one click. Abackup of this database is automatically done. See 7 to retrieve thebackup. See previous chapter to re-inject it.

3.8. Authentication exceptionsBy default, ALCASAR is configured to stop the network flow from a user not logged in. Nevertheless, you can define some exceptions : to allow auto update of antivirus and auto-update of operating systems (See 11.2) ; On Windows : to

keep the Internet access icon on, even if nobody is connected. to access a server or a security zone (DMZ) located behind ALCASAR ; to allow some devices to not be intercepted;

a) To trusted sites or trusted domain names In this window, you can input trusted site names ortrusted domain names. In case of a domain name,all the linked sites are allowed (example : .free.fr allows ftp.free.fr, www.free.fr, etc.).You can display a weblink to a trusted site on theALCASAR homepage.


In order to ease the management of new users, you can define their group of ownership.

For each import, a file including logins and password is available during 24 hours (txt and pdf format).

b) To trusted IP addresses or trusted network IP addresses

In this window, you can manage trusted IP addresses or trusted network ip addresses (a DMZ for example). Thenetwork protocol filtering, if enabled (see 4.2.c), has no effect on the addresses mentioned here.

c) Allowing trusted client devicesIt is possible to allow some client devices to go through ALCASAR without being intercepted. In order to do that, create a user whose name is the MAC address of the device (example: 08-00-27-F3-DF-68) and the password is password. It should be borne in mind that in this case, traces of connection to the Internet will be charged to the device (not to the user).To have more information on the MAC address, you can add userinformation in the user info menu (like in the following screenshot).In order to be imediatly considered, the chilli service must be restarted(see 9.3).

3.9. Auto-registration via SMS

a) Purpose, principle and prerequisite :The objective of this module is to provide to the users a self registration, while respecting the legalrequirements. In order to work, this module required a GSM modem (also called 3g key), and a subscription toa mobile operator.How does it work? The user who want an ALCASAR account in order to access to the Internet send a simpleSMS to number of the ALCASAR 3g key. The SMS content is the password, and the phone number of the useris the login. When the SMS is received by ALCASAR, the account is created.During our tests the following 3g key were used : Huawei E180

~ 30 Connectivity: USB Power : USB Little issue with the Huawei firmware. Configuration : at19200

Wavecom Fastrack suprem 10 ~ 60 Connectivity: RS-232 (with an RS-232/USB link) Power: Power mains No issues. Configuration : at115200

Wavecom Q2303A Module USB ~ Connectivity: USB Power: USB No issues. Configuration : at9600


b) enable the service :

If a valid 3g key is connected:

(1) This number must be written as the international pattern: +xxYYYYYYYYY. xx for country indicative. YYYYYYYYY for the phone number (9 digits). This number will be write on the user information page(see next ).

(2) Be careful, If the PIN code is wrong, the SIM card will be locked. In this case, follow the instructions in thedocumentation alcasar-2.9-technique.odt - 8.2 Auto-inscription par SMS to unlock it.

(3) This field give a value (in days) for a valid account.

(4) A policy against the spam has been implanted : Number of tries allowed by phone when receiving an invalid password (just one word in the content of

the SMS). If the number of try is exceed, the phone number of this user will be banned for a time (in days). Each

phone number ban will be ignored by ALCASAR.

5) Each 3g key has a different baud rate transfer. See previous chapter to find the rate for the 3g keys we havetested. A bigger list of configuration can be find on : http://wammu.eu/phones/

If all is set correctly, you can start the module with the starts button.

This table show the status of the service, the signal strength, the IMEI number and the number of SMS received(reset when the service is stopped).


Show the service status

Phone number of the 3g key(1)

PIN code to unlock the SIM card Be sure!!!(2)

Time available when a account is created(3)

Number of try before a ban(4)

Time of a ban(4)

Configure the baud rate connexion(5)

You can have an acces to the configuration of this module in the autoregistration entry.

If no 3g key are plugged, the configuration page is disabled.

c) User interfaceOnce the service is started, the interception page provides anadditional link Auto registration .

This link gives some information about the SMS account alreadycreated. Moreover, each user can have an information on the status ofhis phone number.

d) Accounts management [administration]Each account created by the auto-registration module has just onattribute : the expiration date. These accounts belong to the usersgroup sms. So, if you want to set an attribute, you can edit thesms user group (see 3.2). These accounts are not seen in thestandard user management section of the ACC.

This table give the state of phone numberwhich have sent one or more SMS. If youclick on delete, the account (if it is alreadyavailable) will be delete, and the user cancreate an account again.

e) Country filteringBy default, the SMS auto registration module allows only french numbers (country code: +33). A web interfaceis available to change the level of filtering:

only french numbers only European numbers Allow every numbers Personal configuration: the administrator can authorize a personal list of country.

f) Error messages [administration]Can not listen the ttyUSB0 port. You 3g key is maybe used by an other program

Timeout. Can not connect to modem. The 3g key has beed deconnected

An issue with your Sim card was detected. Is it in the key? The Sim card is not in the 3g key

Warning, during the last startup, the PIN code was wrong.The Sim card must be blocked. Please read the documentation.

The PIN password is invalide. The SIM card is maybe blocked. Please instructions in the technical documentation of ALCASAR (8.2 - Auto-inscription par SMS .


4. FilteringALCASAR has several optional filters:

a blacklist and a whitelist of domain names, URLs and IP addresses; an anti-malwares on the WEB flow; a filter for network protocols.

The first filter was developed at the request of organization likely to welcome young people(schools, secondary schools, recreation centers, etc.). This filter can be compared to the parental/school controlsystem. You can enable or disable it for each user (or group of users) bymodifying users or groups attributes (see 3).The anti-malware can detect a lot of type of files (virus, worm, phishing, etc.).It can be combined with previous filter. It is enabled by user. It is updated every4 hours.Domain names, URLs and IP addresses are referenced in two lists. Either you operate a whitelist. The filtered users using that list can access only the sites and IP addresses of

the whitelist Either you operate a blacklist. The filtered users using that list can access all the sites and IP addresses

except those of the blacklist.On ALCASAR, this filter runs on all network protocols. For example, if the domain name warez.com isblocked, all protocols for this domain will be blocked (HTTP, HTTPS, FTP, etc.).ALCASAR uses the excellent list (black + white) drawn up by the University of Toulouse (France). This listwas chosen because it is distributed under a free license (creative commons) and its content refers to France. Inthat list, domain names (eg www.domaine.org), URLs (eg www.domaine.org/rubrique1/page2.html) and IPaddresses (eg 67.251.111.10) are listed by categories (games, astrology, violence, sects, etc.). The ACC allowsyou : to update that list and to define the categories of sites to block or to allow; to rehabilitate a blocked site (exemple : a site that was banned, was closed and purchased by new people); to add sites, URLs or IP addresses that are not in the list (CERT alerts, local directive, etc.).

4.1. Blacklist and whitelist

a) Updating the listThe update of the blacklist will download the latest version of thelist of the University of Toulouse (France) and will install it. Oncethe file is downloaded, ALCASAR calculates and displaysits fingerprint. Then, you can compare this fingerprint withthe one available on the website of the university ofToulouse. If the two are identical, you can confirm theupdate. Otherwise, discard it.

b) Editing the blacklist You can choose categories to filter and restore or add sites to the blacklist .

By clicking on the category name, you display its definition and the number ofdomain names, URLs and IP addresses it contains. By clicking on one of these number, you display the first 10sites.You can rehabilite domain names or IP addresses.You can add domain names or IP addresses directly in the ACC or by importing text file (one domain or oneaddress per line).Info: if you want to test site filtering or site restoring, remember to clear the cache memory of the browsers.


c) Special blacklist filteringThe blacklist has two special filters available for HTTP protocol.The first one blocks URLs containing an IP address instead of adomain name.The second one exclude results from search engines that may notbe suitable for minors ("Safe search" function). This second filter is compatible with "Google", "Yahoo", "bing"and "metacrawler". This second filter works only on HTTP requests.It works with YouTube only if you get a Youtube ID. For that,visit : http://www.youtube.com/education_signup. Once yourYouTube account is created, copy the ID in the ACC and savethe changes.

d) Whitelist

As for the blacklist, you can select categories and add your own domain names and IP addresses.Note : liste_bu is a category used by french students (bu=bibliothque universitaire=university library). Thiscategory contains a lot of useful websites validated by teachers and learning teams.

4.2. Protocol fi lteringWhen this filter is not enabled, a logged in user can use any protocol (Internet access is limitless). All theactions of logged in users are traced and recorded regardless of the protocol used.When the filter module is enabled, only the HTTP protocol is enabled by default. All other protocols areblocked. It is possible from this restrictive mode, to enable, one by one, the network protocols you want toallow. A list of standard protocols is presented by default. You can enrich it.

ICMP is used for example by theping command.

SSH (Secure SHell) : to allowsecure remote connections.

SMTP (Simple Mail TransportProtocol) : to allow emails to besent from a thick client (outlook,thunderbird, etc.).

POP (Post Office Protocol) : toallow thick clients to downloademails.

HTTPS (HTTP secure) : to allowsecure web surfing.

Note: When enabled, this filter is active for all users. In future, ALCASAR will be able to associate it (or not) toeach user (as for blacklist/whitelist/anti-malware).


Once your account is created, get your Youtube ID(character string just after the ':' character).

5. Access to StatisticsStatistics are available on the ACC (menu "statistics"), after logging in.This menu provides access to the following information:

number of connections per user per day (updated every night at midnight); connection status of users (updated in real time); daily load of the portal (updated every night at midnight); global & detailed network traffic (updated every 5 minutes); security reports (updated in real time).

5.1. Number of connections per user per dayThis page displays, per day per user, number, connection time and volumes of data exchanged. Please note: the volume of data exchanged is what ALCASAR sent to the user (upload) and what it receivedfrom the user (download).

5.2. Connection status of usersThis page lists log-in and log-out events from the portal. An input box allows you to specify your search and display criteria.With no search criteria, the chronological list of connections is displayed (since the installation of the portal). Please note: the volume of data exchanged is what ALCASAR sent to the user (upload) or what it received fromthe user (download).

- Example of search No1 : Display, in chronological order, of the connections established between June 1 andJune 15, 2009 with the default display criteria:


Cumulative timeNumber ofconnectionsVolume of data

exchanged

One line per day

Select your display criteria here. Criteria have been pre-defined. They meet most needs (user name, IP address, log-in, log-out, volume of exchanged data). Use and to change the selection.

Select your search criteria here. By default, no criteria is selected. The list of connections made since the installation of the portal will be displayed in chronological order.Two examples of search are detailed below.

You can customize this state by:- Filtering on a particular user;- Defining a certain period of time;- Sorting with different criteria.

User name

- Example of search No2 : Display of the 5 shortest connections during the month of July 2009 and with the IPaddress 192.168.182.129". The display criteria include the cause of disconnection but not the volume of dataexchanged:

5.3. Daily useThis page allows you to know the daily load of the portal.

5.4. Global and detailed trafficGlobal traffic

This graph allows to show network statistics by hour, day, month.


Here, set the period. You can specify a particular user (leave this field blank to accommodate all users).

Detailed trafficThis page shows the statistics for outbound network traffic (by day, by week and by month). The dataare updated every 5.

The details menu allows you to zoom on a particular time slot. For the HTTP flows, network IP addressesare hidden and replaced with the IP address of ALCASAR.

The plugins menu shows the network trafficbased on the traffic protocol (port tracker). You can seethe protocols currently in use (now) or all protocolsused during the last 24 hours.


SURFmap is a plugin which gives the possibility tohave a visual of all the flows (not only HTTP).

Different filters are available in the Menu : number offlow, begin and end date, show just the flows of one@ip (src host 123.123.123.123)

Do not enter a huge value of flow. More this value ishight, more the time of process is high.

The Auto-refresh checkbox refresh this page each 5minutes.

5.5. Security ReportThis page displays three safety information identified by ALCASAR:

The list of users disconnected due to a MAC address spoofing of their device; The list of malwares intercepted by the integrated antivirus; The list of IP addresses banned during 5 by the intrusion detection system. The reasons can be : 3

successive SSH connection failures 5 successive connection failures on the ACC 5 successive loginfailures for a user 5 successive attempts to change password in less than one minute.

6. Backup 6.1. Connection logsThe menu "Backup" from the ACC displays, in the first column, the list oftraceability files containing the users activity logs. To save them on anothermedia "right click" on the file name, then "save target as".These files are automatically generated once a week in the directory /var/Save/larchive/ . Files older than one year are deleted.

In case of legal inquiry:In a legal inquiry, law enforcement officials may ask for connection logs of your users. Give them the file of activity of the week of the offence.If the officials ask for the files of the current week , create this file via the menu.


User logged out due to MAC address spoofing

IP address blocked by the IDS

Malware blocked- EICAR test files- Trojans- Virus

6.2. The users databaseThe menu "Backups" from the ACC displays, in the second column, backupfiles (in compressed "SQL" format) of the users database. They can begenerated at any time by clicking in the menu Create the current usersdatabase file.These files can be imported in ALCASAR (cf. 3.6.a). You can use thesefiles when reinstallation of the portal (see 8.4).

7. Advanced features 7.1. Administration accounts managementALCASAR server has two system accounts (or Linux accounts) that were created during the installation of theoperating system:

root : This is the account used for system administration ; sysadmin : This account allows you to take secure remote control of your system (see next ).

Along with these two "system" accounts, "management" accounts have been defined to control some functionsthrough the graphical ALCASAR Control Center (ACC). These "management" accounts can belong to one ofthe three following profiles:

admin : this account give access to all the functions of the ACC. A first admin account was createdduring the installation of ALCASAR (see Installation documentation);

manager : this account only give access to users and groups management functions (see 3) ; backup : this account only give access to backup and archiving of log files (see previous chapter).

You can create as many management accounts as you want in each profile. To manage these managementaccounts, use the alcasar-profil.sh command as root :

alcasar-profil.sh --list : to list all the accounts of each profile alcasar-profil.sh --add : to add an account to a profile alcasar-profil.sh --del : to delete an account alcasar-profil.sh --pass : to change the password of an existing account

7.2. Secure administration across the InternetIt is possible to establish a secure remote connection toan ALCASAR portal using encrypted data flow ("SSHprotocol" - Secure SHell). Lets take an example of anadministrator who seeks to administer, through theInternet, an ALCASAR portal or devices on theconsultation network. Firstly, you need to enable the"SSH" service on ALCASAR (menu "system" and"services"). You must know the IP address of theBroadband modem/router#2.

a) Broadband modem/router configurationIt is necessary to configure broadband modem/router#2 so that it doesnt block the "SSH" protocol. Toanonymise the SSH data flow on the Internet, the default port (22) is replaced by another one (52222). If youwant, you can still use the port 22.Refer to your broadband modem/router documentation before performing this operation.


Internet

Router2

ALCASAR Network

ALCASAR

Router1Port 52222

Port 22

b) administration of ALCASAR in text modeYou can log in remotely to ALCASAR using the Linux sysadmin account created during the installation ofthe system. Once you are logged in, you can use the administration commands of ALCASAR (see 11.1). Usethe su command to become "root". On Linux, install "openssh-client" (you can also install

"putty") and run the command ssh -p [email protected] (replace w.x.y.z with the public IPaddress of the broadband modem/router#2 and replace the"external_port" with the listening port number of thebroadband modem/router#2 (52222 in our example). You can add the -C option to enable the compressionalgorythme.

On Windows, install "Putty" or "putty-portable" or "kitty" and create a new session:

click on "Open", accept the server key and log in as "sysadmin".

c) Administration ALCASAR in GUI modeThe goal is now to redirect the data flow from the workstation's browser to ALCASAR in a SSH tunnel. Tocreate this tunnel: On Linux, run the command:

ssh -L 10000:@IP_eth1_alcasar:443 -p 52222 [email protected] On Window, configure putty as describe bellow:

Start your browser and go to : https://localhost :10000/acc/acc/ in the end of URL is important!


Public IP address of the broadband modem/router#2

Listening port for the administration in ssh mode

Protocol

Session name

Save the session before finish

- Load the previous session- On the left side of the windows, select "Connection / SSH / Tunnels- In "Source Port" enter the port of entry of the local tunnel (greater than 1024 (here 10000))- In "Destination", enter the IP address of eth1 of alcasar1 followed by the port 443 (here 192.168.0.1:443)- Click on "Add"- Select "Session" on the left side- Click on "Save" to save your changes- Click on "Open" to open the tunnel- Enter the user name and password

d) Managing devices on the ALCASAR networkFollowing the same logic, it is possible to manage any device connected to the consultation network (WIFIaccess points, switches, LDAP / AD, etc.). On Linux, run the command: ssh -L 10000:@IP_equipment:Num_Port -p 52222 [email protected] .

@IP_quipment is the IP address of the device to manage. NUM_PORT is the administration port of this equipment (22, 80, 443, etc.).

On Windows, enter the IP address and the port of the device in the form "Destination" of "Putty".

Run the command : ssh login@localhost:10000 to use SSH for secure remote administration.To connect the web-based interface, go to : http(s)://localhost :10000 .

e) Use of SSH tunnel with public / private key pair (public/private key)This paragraph, although not essential, adds an additional layer of security using private key authentication. generate a keys pair (public key / private key)

On Windows with puttygen

Linux with ssh-keygen In your personal directory, create the directory .ssh if it is not exist. From this one, generate your public/private key pair ( ssh-keygen -t rsa -b 2048 -f id_rsa ). The command cat id_rsa.pub displays your public key and allows you to copy it.

Copy the public key on the remote portal: run the following command to copy your public key directly on the remote server:

ssh-copy-id -i .ssh/id_rsa.pub sysadmin@ Enter your password; your public key is copied in the sysadmin/.ssh/authorized_keys automatically with

the correct permissions. Another method : log on through SSH to the remote ALASAR as "sysadmin" and execute the following

commands : mkdir .ssh then cat > .ssh/authorized_keys ; copy the contents of the public key from the clipboard ("Ctrl V" for Windows, middle mouse button

for Linux) type Enter then Ctrl+D ; protect the directory : chmod 700 .ssh and key file chmod 600 .ssh/authorized_keys ; check the file : cat .ssh/authorized_keys and log out : exit .

Connection test from Linux host : slogin [email protected] Connection test from Windows host :

load the previous session of putty; on the left side, select "Connection / SSH / Auth"; click on "browse" to select the key file; on the left side, select Session;


- ouvrir puttyGen- cocher SSH-2 RSA- entrer 2048 comme taille de cl- cliquer sur generate- Bouger la souris afin de crer del'ala

The keys are now created.- Enter a representative comment in the "Key-comment" field;- Enter and confirm the passphrase in the "Key passphrase" field;- Save private key by clicking on "Save private key";- Select and copy the public key (right click)

- open PuttyGen- check the SSH-2 RSA box- specify a key length of 2048 bits- click on generate- move the mouse to generate random values.

click on "Save" then on "Open"; enter the user "sysadmin"; the key is recognized, it remains only to enter the passphrase.

If now you want to prevent the connection with passphrase, configure the sshd server: become root (su -) and set the following options on the file /etc/ssh/sshd_config :

ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no

restart the sshd server( service sshd restart ) and close the ssh session( exit ).

7.3. How to display your logo ?It is possible to display your logo by clicking on the logo on the upper rightcorner of the ACC. Your logo will be inserted in the authentication page andat the top of the page of your management interface. Your logo must be in"png" format and its size must not exceed 100KB. Refresh the page to see thechange.

7.4. Server certificateData is encrypted between ALCASAR and devices on the ALCASAR network in the following cases:

for users : authentication request and changing passwords;

for administrators : access to the ACC (ALCASAR Control Center).

Encryption uses TLS protocol with a server certificate and a local certificateauthority (CA) created during the installation. This server certificate has avalidity of four years. You can check it on homepage of the ACC :

If the server certificate is expired, you can regenerate it with the following command : alcasar-CA.sh .

It will be necessary to remove the old certificate from browsers before installing the new one.

a) Install an official certificateIn version 2.0 and higher, it is possible to install an official intranet certificate issues from a certificate authority(CA). The installation of such a certificate ovoids security warning dialog box on browsers that did not installthe ALCASAR root certificate (cf. 2.2.c). Unlike "Internet" certificates which certify a domain nameregistered at a registrar, an "intranet" certificate can certify a private IP address or a simple server name(hostname). This is the case of ALCASAR whose "hostname" is always "alcasar". To obtain your certificate,follow the instructions as noted on the site of the certificate authority. Please note that the web server used byALCASAR is an "APACHE" server with a SSL module. The following example presents an "intranet"certificate installation generated by the certificate authority (CA) "Digitalix".

First, you will have to execute the following command on ALCASAR as"root" :

openssl req -newkey rsa:2048 -new -nodes -keyout alcasar.key -out alcasar.csr This command creates two files : the private key (alcasar.key) and thecertificate signing request (alcasar.csr).

Copy the certificate signing request on a USB flash drive to copy its contents on the site of thecertificate authority. he CA must provide you a file containing your official server certificate(alcasar.crt). If needed, you also have to download the intermediate authority certificate of your CA (forDigitalix, it is available here: http://www.digitalix.fr/certs/HACert-bundle.crt).

As "root", copy the three files alcasar.key , alcasar.crt and HACert-bundle.crt in your directory(/root). Then, execute the following commands :

1. cd /etc/pki/tls (moves in the certificate directory)2. mv certs/alcasar.crt certs/alcasar.crt.old then mv certs/server-chain.crt certs/server-chain.crt.old and finally mv

private/alcasar.key private/alcasar.key.old (backup of the old certificates)3. cp /root/alcasar.crt certs/ et cp /root/alcasar.key private/ (copy of the official certificate and of its private


key)4. if your CA owns a intermediate authority certificate: cp /root/HACert-bundle.crt certs/server-chain.crt

else : cp certs/alcasar.crt certs/server-chain.crt5. Restart the Apache web server with the command service httpd restart .

If youre having problems: either you reverse the instructions of the second line; or you regenerate new local certificates with the

command : alcasar-CA.sh ; restart the Apache Web server with the command : service httpd restart .

b) Copy of a certificate on several ALCASAR serverIf you use several ALCASAR server, it could be interesting to copy the server certificate from a reference ALCASAR server to other ALCASAR servers. If you installed an official certificate, execute the commands from the points 1 to 5 from the previous section on the differents ALCASAR servers. In the case of a certificatecreated during installation, copy the five following files from the reference ALCASAR to the other servers: for the certification authority : /etc/pki/CA/alcasar-ca.crt and /etc/pki/CA/private/alcasar-ca.key for the server certificate : /etc/pki/tls/certs/alcasar.crt, /etc/pki/tls/certs/server-chain.crt and

/etc/pki/tls/private/alcasar.keyRestart the Apache Web server with the command : service httpd restart .

7.5. Use of an external directory server (LDAP or AD)ALCASAR contains a module capable of requesting an external directory server (LDAP or AD) located eitheron the LAN side or on the WAN side.When this module is enabled, ALCASAR uses the external directory to authenticate a user, but, if an erroroccurs, the local database will be used.In all cases, user events logs are recorded in the local database of ALCASAR. Here id the management GUI ofthis module :

Remark : attributes of users from the external directory cant

be modified with the ACC; use of the secure protocol "ldaps" is not available for

now. The network segment between ALCASAR andthe directory server must be under control, forobvious reasons of security (cf. 10);

External directories do not support case sensitiveunlike the local database of ALCASAR.

Example: This screenshot shows the AD directory tree organized as follows:standard users are put into the Organizational Unit (O.U.) "User".The account used by ALCASAR to request the directory is the account "rldap"in the OU "Admin". This account is a standard acount that does not needspecial rights.Both O.U. "Admin" and "User" are located themselves in the OU "User". DN of the database : ou=User,ou=Utilisateur,ou=site_i2sc,dc=i2sc,dc=local -->

research base of users, and this root is to be adapted to the organization of thedirectorry tree.

LDAP ID : sAMAccountName --> for AD; uid in general for other LDAP Filter : leave this field empty unless you want to select only specific users. LDAP user : cn=rldap,ou=Admin,ou=site_i2sc,dc=i2sc,dc=local

Please note that this field and the field Password can be left blank if the directoryserver accepts requests in anonymous mode.

Password : password of the user rldap


From an external directory server (LDAP or AD) and in order to provide to users some attributes specific toALCASAR (bandwidth, concurrent session, etc.), it is possible to create a group named "ldap" (respect lowercase letters) for which you set the desired attributes.

It is also possible to assign attributes to a particular account authenticated on an external directory. To do this,create a user in the ACC with the same name / identifier as that is in the directory.

7.6. Integration in a complex architecture (AD, external DHCP, LDAP)ALCASAR can be installed in an existing network with a Windows domain, a DHCP server and an externaldirectory for the authentication process (LDAP or AD) (see previous ).

a) Managing Windows DNSIf your existing environment already has Active Directory enabled, then, Windows computers of your domaincontroller must request the DNS of this controller for specific resolutions of the domain and they must requestALCASAR for Internet access. One solution is to configure the ALCASAR DNS so it redirects to the domaincontroller the DNS queries concerning resolution of the domain. In this way, devices are configured with anunique DNS : ALCASAR.On ALCASAR, the only change to make is to add the following line in the file /usr/local/etc/alcasar-dns-name :

'server=//'Example : brock.net domain is managed by the AD/DNS server 192.168.182.10. The line to add is :server=/brock.net/192.168.182.10Please note that it is the domain name and not the name of the server srv-ad.brock.net.Restart the service DNSMASQ to take your changes changes into acccount ( service dnsmasq restart ). Reminder : The DNS suffix 'localdomain' of static IP devices is mandatory.So, computers (whether in static IP address mode or in DHCP mode) integrated into a Windows domain must

have their primary DNS suffix configured with the Windows domain name and in addition with the suffix'.localdomain'.

b) Using an External DHCP ServerWith an external DHCP server, ALCASAR must not assign network settings anymore, but this task must be iscarried out by the external DHCP server.

In order to do this, ALCASAR will act as a relay agent to enable assignment of IP addresses by the DHCPserver.It is necessary to stop the ALCASAR DHCP server (in the ACC: System/Network: No DHCP mode) and tomodify the following variables to manage the external server (configuration file /usr/local/etc/alcasar.conf ) :

EXT_DHCP_IP= RELAY_DHCP_IP= RELAY_DHCP_PORT= : (default 67)

The external DHCP server must be configured to provide to devices: a range of IP @ corresponding to the range allowed by ALCASAR (default 192.168.182.3 to 254/24)

Warning: ALCASAR keep for itself the following address for its internal interface: 192.168.182.1 and 192.168.182.2.

a gateway address corresponding to the internal IP address of ALCASAR (by default 192.168.182.1); the DNS suffix "localdomain"; the IP address of the DNS server -> the internal IP address of ALCASAR (default 192.168.182.1); the IP address of the time server (NTP) -> the internal IP address of ALCASAR (default 192.168.182.1)

or the domain controller (to avoid temporal drifts, synchronize the server clock with a trusted NTP server on the internet or with the ALCASAR server).


7.7. Encryption of log filesALCASAR can automatically encrypt weekly log files (cd. 7.1). For this, it uses the GPG asymmetricalgorithm (public key + private key).By Providing the private key to an afficial of your company, you prevent administrators from being accused oflog files modification.In case of inquiry, simply provide log files and the private key for decryption.The procedure for activating the encryption is as follows:

Printscreen Comments To do

- Log on as root .- Start the entropy generator (randomvalues).

rngd -r /dev/urandom

- Generate the key pair (public key + private key).- Choose the algorithm, the size and the lifetime of the keys (no expiration).- Choose a user name and passphrase.

gpg --gen-key

info: The user name must not contain spaces. Thisname is summarized in the term later inthis procedure.

- Stop the entropy generator. killall rngd

- Export the private key. Copy this to an external media.- Provide it (with passphrase and username) to an official of your organization (Private key escrow).

gpg --armor export-secret-key \ > alcasar_key.priv

info : cf. installation doc for the USB management.

- Delete the previously generated keys- Delete the private key from the GPG keyring

rm -f alcasar_key.priv

gpg --delete-secret-key

- Enable encryption by changing thevariables "CRYPT" and "gpg_user" in thefile /usr/local/bin/alcasar-archive.sh .

1. vi /usr/local/bin/alcasar-log-export.shinfo : assign the "username" to the variable gpg_user

Infos :

ALCASAR uses the keyring "root" in the directory /root/.gnupg ; 'gpg list-key' : allows to list all the key pairs contained in this kit; 'gpg --delete-key ' : deletes a public key keyring; 'gpg --delete-secret-key ' : deletes a private key keyring; You can copy the directory /root/.gnupg on another server ALCASAR. Thus, you can use the same

key and the same ; To decipher an encrypted archive:'gpg decrypt -files '.


7.8. Managing multiple Internet connections (load balancing)ALCASAR has a script to distribute requests over a number of gateways to the Internet "alcasar-load_balancing.sh start | stop | status".The parameters are not included in the ACC, it is necessary to modify the global configuration file "alcasar.conf" located under "/ usr / local / etc".Associated parameters (virtual networks card, weights, gateway ip address, etc.) must be defined in the following format: WANx = "active [1 | 0], @ IPx / mask, GWx, Weight, MTUX".The script creates the interfaces on the fly.To make it active, the parameter MULTIWAN must include the "on" or "On" value; otherwise insert the "Off"value to enable the "single gateway" mode.The connection test frequecny is set by default to 30 sec.Please note: The parameter "FAILOVER=0" enables the MULTIWAN mode with no connection test to the gateways (no gateway failure detection).

7.9. Creating an ALCASAR dedicated PCThis chapter presents an example of a dedicated PC ALCASAR (appliance) whose constraints are : miniature(mini-itx), low noise, low cost and low energy consumption.

The configuration is the following : Case mini ITX (12V powerline); motherboard GigaByte GA-J1900N-D3V (two network cards and Intel 4-core Celeron); 4GB of DDR3 SODIMM memory; HDD 2.5' 200GB SATA.

The cost of this configuration is around 250 (shipping included).The consumption of this mini-PC is not more then 30W; the cost of the annual electricity consumption inFrance is about 30 (30 * 24 * 365/1000 * 0.1329).ALCASAR is installed via a USB drive as usual.Once deployed, the unit requires no keyboard, no mouse and no screen.

7.10. Bypassing the portalFor reasons of maintenance or emergency, a portal by-pass procedure was created. It disables user authentication and filtering.Logging network activity remains active.Network event logging remains active, but ALCASAR does not trace internet connections anymore.

Bypass the portal by running the script alcasar-bypass.sh --on . To stop it, run the script alcasar-bypass.sh --off .

Please note:Bypass mode is no longer active after restarting the server.


SSD

Memory: 4GB of DDR3

8. S hutdown, restart, update and reinstallation 8.1. Shutdown and restartThere are three possibilities to stop or restart properly the system:

Via ACC by briefly pressing the power button of the PC; by connecting to the console as root and running the command "init 0";

When restarting the portal ALCASAR a procedure deletes all connections that have not been closed due to anunplaned shutdown (failure, power failure, etc.).

8.2. Operating system updateMageia-Linux provides an excellent mechanism to apply security patches on the system and its components.ALCASAR has been developed to be fully compatible with this mechanism. So, every night at 3:30, thesecurity updates are downloaded, checked and applied. As root, you can manually update the system with thecommand urpmi auto --auto-update .Once the update is complete, a message may warn you that a system reboot is required. This message appearsonly if a new kernel or a major library were updated.

8.3. ALCASAR minor updatesYou can see if an update is available on ALCASAR web page, or on the cover page of the ACC, or byexecuting the following command alcasar-version.sh . Download and extract the archive of the latest versionlike a normal installation.When starting the installation script ( sh alcasar.sh --install ), it detects your current version and offers you thepossibility to update automaticly ALCASAR to the latest version available. Only minor updates can be done by that way. If it's impossible, the script ask you to perform a reinstallation.During an minor update, the following settings will still remain:

network configuration; the name and logo of the organization; logins and passwords for administrative accounts of the portal; users and groups database; main and secondary blacklists; trusted sites and MAC addresses list; network filtering configuration; the certificates of the Certification Authority (C.A.) and the server certificate.

8.4. ALCASAR major update or reinstallationVia ACC, create a backup of the current users database (see 6.2 ). Save this backup file on a extern system.Install the new operating system and the new version of ALCASAR (see installation documentation).Via ACC, import the users database (see 3.6.a).


9. TroubleshootingIf you have any problem with ALCASAR, this chapter sets out several troubleshooting steps that may indicatethe cause. All commands (italic text on a yellow background) must be run in a console as root .

9.1. Network connectivityRetrieve the network informations in the file /usr/local//etc/alcasar.conf Check the network card status: run the command ip link to know the name of your two network cards. In

this doc we use the following name : INTIF for the card connected to the consultation network. EXTIFis connected to the Internet. Run ethtool INTIF and ethtool EXTIF in order to check the status of bothnetwork cards (Link detected and Speed fields for example) ;

gateway/router connection test: Run the command route -n to display the IP address of the broadbandmodem/router. Ping the broadband modem/router (Internet router). If an error occurs, check the cableconnections and the status of the gateway/router;

External DNS servers connection test: Ping the DNS servers. If an error occurs, try with another server; Internal DNS server connection test (dnsmasq) : Send a name resolution request (ex. : nslookup

www.google.fr). If an error occurs, check state of the service "dnsmasq". You can restart the dnsmasq service with the command : systemctl restart dnsmasq ;

Connection test to the Internet: run the command wget www.google.fr . In case of success the Google page is downloaded and saved locally (index.html). The result of this test is displayed in the menu "system / service" of the ACC;

Device connection test : Run the command arping -I INTIF @ip_equipment to know if a device is connected to the ALCASAR network.

To discover all the device, install the arp-scan package (urpmi arp-scan) and run the command arpscan -IINTIF --localnet ; 00:1C:25:CB:BA:7B 192.168.182.100:11:25:B5:FC:41 192.168.182.2500:15:77:A2:6D:E9 192.168.182.129

9.2. Available disk spaceIf the available disk space is not enough, some modulesmay not run properly anymore. You can check the availabledisk space (especially the /var partition ) :

in GUI-mode via the homepage of the ACC; in text mode, using the command df

In case of excessive reduction of this space, delete old log files after they have been archived(directory /var/Save/*).

9.3. ALCASAR server services In order to complete these tasks, ALCASAR uses several server services. The status of these services isdisplayed in the ACC (menu system/services ). You can stop or restart them.

If one of these services can't be restarted, you can diagnotic the mistake. Connect to the console of ALCASAR(directly or with SSH). You can control the services with the command systemctl start/stop/restart service_name .At the same time, display the log file with the command journalctl -f .

9.4. Client devices connectionIn the ACC (menu "System / Activity"), make sure that all yourclients' network settings are correct (MAC address / IP address). Ifnot, delete the old settings set by ALCASAR and save the new


correct settings..On the client devices : check the network settings: run ipconfig /all on Windows, /sbin/ifconfig on Linux ; if they are not correct, update them. For devices that use dynamic IP addresses, send again a

DHCP request : ipconfig /renew on Windows, dhclient eth0 on Linux. If the interface is not configured, check the cable connections and make sure that DHCP frames of your clientpass on the network (use the network analyser "Wireshark" for example). On ALCASAR, you can see incomingDHCP requests by running the command journalctl -f or by displaying the terminal 12 ( + F12).

Connection test to the portal : Send a ping request to the IP address of ALCASAR. If an error occurs, check the cable connections and the network settings. Name resolution test : On Windows and on Linux, run nslookup alcasar . The result should be the @IP

ALCASAR. In case of failure, If not, check that ALCASAR is the DNS server of the client. The ACC: On a client, with a browser try to connect to ALCASAR (http://alcasar). Internet Connection test : Try to visit a site on Internet. ALCASAR must "intercept" your request and

display the login window.

9.5. Connection to ALCASAR with a serial terminal It can be useful to use a keyboardless and screenless server. Below, the tutorial explains how to connect to aserial terminal (thank you Igor Popowski) :File /etc/inittab : save the original : cp /etc/inittab /etc/inittab.save

edit the file : vi /etc/inittabbefore this line : # Single user mode , add the following lines:#connexion au terminal serials0:2345:respawn:/sbin/agetty -L 9600 ttyS0 vt100 -f /etc/issuethen save Esc then :wq!

File /etc/securetty : save the original : cp /etc/securetty /etc/securetty.save

edit the file : vi /etc/securetty add one of the two following line at the end of file:ttyS0 if using a 9-pin serial portttyUSB0 if using a Serial / USBand save Echap and :wq!

run the command init q to account for this change.

To display the output of the boot in GRUB, edit the file /boot/grub/menu.lst save the original: cp /boot/grub/menu.lst /boot/grub/menu.lst.save

in the section 'title linux' after adding vga=791 to end of line :console=tty0 console=ttyS0,9600n8 by standard serial portconsole=tty0 console=ttyUSB0,9600n8 in USB port

Connect your management station to ALCASAR with a null modem cable on the serial port COM1 (or through a serial/usb adaptator).Configure PuTTY to use this COM1 serial connection in vt100 mode.


9.6. Problems experiencedThis chapter presents feedbacks of organizations who have faced problems and have solved them.

a) On some sites, pictures are not displayedWhen the domain names and URLs filtering is enabled, by default, ALCASAR filters links without domainname (links containing IP addresses). Thus, pages containing this kind of links are partially displayed.To prevent from this problem, two solutions : uncheck the IP box from the blacklist (cf. 5.1.c) or save theIP addresses contained in these links as "Domain names rehabilitated" (cf. 5.1.c).For example, the site "leboncoin.fr" hosts its pictures on the following IP addresses : 193.164.196.30, .40, .50and .60 and 193.164.197.30, .40 and .50.

b) Navigation impossible with some antivirusDisable the proxy-web function integrated in some anivirus. In Trend-Micro antivirus, for example, this function relies on a whitelist/blacklist downloaded from the servers of Trend Micro ( backup30.trendmicro.com, etc.) that analyses/validates each request of a website... A limited rights user can enable it.To avoid all inconvenience of this function incompatible with ALCASAR, it is better to stop the service Proxy Trend service and to restart the computer.

c) Windows Stations previously connected to a public hotspotWhen a system connects to a "public hotspot", it provides network parameters and a lease time whichdetermines the validity time of these parameters. Windows XP stations do not reset these settings during areboot.Thus, even if they change of wifi network, they will try to connect with the parameters of the previous hotspot.This problem is recognized by Microsoft that offers the following solution: Manually force the refreshing of theip address with the command ipconfig /renew .

d) Windows clients with static addressingIt is necessary to add the DNS suffix localdomain ( Network configuration / Advanced / DNS).

e) No Internet browsing but the browser accesses the homepage of ALCASAR (http://alcasar)This can occur after a complete reinstallation of the portal or after an update with a change of the servercertificate. Browsers display the following pages when they attempt to access a website:

With IE6 With IE 7 - 8 and 9 With Mozilla

This is because browsers try to authenticate the ALCASAR portal using an old certificate.The old certificate must be deleted on the clients' browsers ( Tools / Internet options / tab content /button Certificates / tab Root certification Authority ) to be replaced by the new one as described inchapter 2.2.c.


f) No Internet browsing but the Trusted sites section is filled inALCASAR verifies the validity of domain names entered in this section (cf. 4.7.a). If a domain name is notvalid, the 'chilli' service can no longer start. Then, change the invalid domain name and restart the 'chilli' servicewith the command service chilli restart .

g) Operating system and memory overloadThe Linux system always attempts to use the maximum amount of memory (RAM) available. On the homepageof the ACC, the bar graph indicating the use of the memory can be regularly beyond 80 percent and can turnred. This is normal. If the system needs more memory, it will use the swap. This swap is an area of the hard diskused when your computer runs out of RAM but this memory is approximately 1000 times slower. If younotice that the system uses swap space (> 1%), you can consider increasing the RAM to significantly improvesystem responsiveness especially when the domain names and URLs filtering is enabled.You can display the system load on the home page of the ACC in 'System /Lload system', or in a console withthe commands top ou uptime :

3 values shown represent the average system load average for the last hour, the five last hours and the last 15 minutes. The average load is the number of processes waiting for CPU usage.These values are normally less than 1.

A value greater than '1 .00' results from an under-sized server (especially if it affects the three values (long-term overload).

Search the process which represents a high proportion of the load (command top ).

10. SecurityOn the consultation network, ALCASAR is the Internet Access Controller. It also helps to protect the networkfrom external threats or from internal threats. To this end, it includes:

protection credentials theft. The authentication flow between devices and ALCASAR users areencrypted. Passwords are stored encrypted in the database;

protection against forgetting to log out. The attribute "time limit of one session" (cf. 4.1) allows toautomatically disconnect a user after a pre-set time;

protection against failures (network or user devices). Devices that do not respond during 6 minutes areautomatically disconnected;

protection against session hijacking by spoofing network settings. This spoofing technique exploits theweaknesses of "Ethernet" and WIFI protocols. To reduce this risk, ALCASAR incorporates an auto-protection process which is running every 3 minutes (alcasar-watchdog.sh) ;

protection of the bootloader (GRUB) of the portal with a password. This password is stored in the file /root/ALCASAR-passwords.txt .

The mere presence of ALCASAR not guarantee an absolute security against all threats, including internal threat(hacker on the ALCASAR network). In most cases, this threat remains very low. Without being paranoid and ifyou really need a high security, the following measures can improve the overall security of your system.

10.1. On ALCASAR Choose a strong "root" password (you can change it by running the command passwd ) ; Protect your "ALCASAR" server and ISP's equipment to prevent unauthorized access, theft or installation

of equipment between the modem and ALCASAR (locked premises, padlocks, etc.). configure the BIOS so that only the internal hard disk drive is bootable. Set a password to access the BIOS setup.

10.2. On the network

a) Network type "hotspot"If you want to set up free access computers, it may be interesting to


install products ensuring both the protection of the privacy and security of these computers (like cybercafe computers). These products allow the user to be compartmentalised in a sealed environment. At the end of his session, the user environment is totally cleaned.

On Linux, you can install the product "xguest" (it is provided natively with Mageia, Mandriva, Fedora, RedHat and Centos distributions)

On Windows, you can chose one of these not free projects : Openkiosk, DeepFreeze, Smartshield and reboot restore RX. They save all the computer and restore it after a reboot. Microsoft gave the software Steady state for XP/Vista. This software is no longer supported.

On WIFI Access Points (AP) : Enable the client isolation option (also called wireless

isolation). It prevents a user connected to an access point tocommunicate with another one connected to the same accesspoint. They can only connect to Internet via ALCASAR.

enable WPA2-Personal encryption (also known as WPA2-PSK). It avoids user to listen WIFI traffic (even if the key is thesame for everyone). You can choose a simple WPA2 key asyour organization name for example.

On switches of wired Ethernet networks : enable "DHCP snooping" on ALCASAR port and on interswitch ports. This will prevent false (fake)

DHCP servers.

b) Controlled networksOn these networks, the stations must be protected by physical measures to ensure their integrity. Physical accessto network consultation must be secured by the following:

disconnect unused network jacks; on WIFI hotspots: camouflage the network name (SSID) enable encryption WPA2 "personal" with a strong key; on Ethernet switches: Enable the "lock port" ("Port Security" function) to associate the MAC addresses of devices to the

physical ports of switches; select the "DHCP snooping" function on the port used by ALCASAR and on the interswitch ports. This

will prevent false DHCP servers (Fake DHCP servers).

Devices can (should) incorporate several security features such as locking the BIOS setup, locking the desktop configuration, antivirus, automatic update security patches (patch), etc.. To facilitate downloading of security patches or antivirus updates(cf. 4.7), ALCASAR can authorize devices to automatically connect without authentication on sites specifically identified.

Make your users aware of these two security features: Password must be changed Credentials must remain confidential (Each user is responsible of "friend's session" using his credentials).


11. Annexes 11.1. Useful commands and filesThe administration of ALCASAR can be done from a command line interface (as 'root'). All these commands(shell scripts) begin with "alcasar-... "and are located in the directories /usr/local/bin/ and /usr/local/sbin/ .Some of them rely on the central configuration file of ALCASAR ( /usr/local/etc/alcasar.conf ). The "-h"argument lists available command line arguments. alcasar-bl.sh {-on/-off} : enables / disables the domain nd URL filtering;

{-download} : download and apply the latest version of the BlackList (BL); {-adapt} : adapt the BL to the ALCASAR architecture ; {-reload} : activate the freshly downloaded BL.

alcasar-bypass.sh {-on/-off} : Enables/disables the BYPASS mode; alcasar-CA.sh :creates a local CA and server certificate. Requires the restarting of Apache web server (service httpd restart) ; alcasar-conf {-apply} : apply the network settings according to the configuration file; alcasar-dg-pureip.sh {-on/-off} : enables / disables the filtering of URLs containing IP addresses (instead of a domain name); alcasar-havp.sh {-on/-off} : enables / disables the antivirus filtering on WEB flows;

{-update} : updates the antivirus database (clamav) ; alcasar-https.sh {-on|-off} : enables / disables encrypted authentication flows; alcasar-load-balancing.sh : Aggregates several Internet connections. IP addresses, bandwidth and MTU of available

modems/routers must be configured in the file /usr/local/etc/alcasar.conf to work properly. Remember, the script is automatically launched when the system starts up only if the MULTIWAN parameter is set up in the file "/usr/local/etc/alcasar.conf". To ensure the script is running properly, execute the command : ip route.(start, stop and status are the options available for this command).

alcasar-logout.sh {username} : logs off user from all his sessions; {all} : logs off all the logged users;

alcasar-mysql.sh {-import fichier_sql.sql} :imports a user database (overwriting the existing one) {-raz} : resets the user database; {-dump} : creates an archive file of the current user database in /var/Save/base ; {-acct_stop} : stops the open accountability sessions;

alcasar-nf.sh {-on/-off} :enables / disables the filtering of network protocols; alcasar-rpm-download.sh : Downloads and creates an archive file of all the necessary packets to install ALCASAR. alcasar-safesearch.sh {-on/-off} : enables / disables SafeSearch filter from the major search engines (blocks inappropriate or

explicit content for young people); alcasar-version.sh : compares the current ALCASAR version with the latest one available on the Internet;

Each service provided by the server is supported by a "daemon", which is managed automatically start:

View the status of a particular daemon (works for most daemons)/etc/init.d/ status

Restart / stop a daemon:/etc/init.d/ {start|stop|restart|reload}

Info : a super daemon checks every 10 minutes service status (alcasar-daemon.sh).

If you need to edit a file, you'll probably need to know some basic features of the text editor "vi". To help you you can consult a summary of useful commands: http://www.computerhope.com/unix/uvi.htm.


Sauvegarder un fichier - quitter vi:w sauvegarde le fichier (penser write):wq sauvegarde le fichier et quitte vi (write and quit) quivallent :x:q quitte vi sans sauvegarder les modifications (quit):q! quitte immdiatement, sans rien faire d'autre:w sauvegarde le fichier sous le nom :w sauvegarde le fichier (penser write):wq sauvegarde le fichier et quitte vi (write and quit) quivallent :x:q quitte vi sans sauvegarder les modifications (quit):q! quitte immdiatement, sans rien faire d'autre:w sauvegarde le fichier sous le nom

Insrer du textei active le mode insertion

Supprimer du textex supprime un caractre (faire une croix dessus)dd supprime une lignendd supprime n lignes

Copier-CollerY copie une ligne, donc la place dans un tampon, pour pouvoir ensuite la coller (yank, tirer)nY copie n lignesp colle les lignes aprs le curseur (paste, coller)

Annuler ou rpter des modificationsu annule la dernire modification (undo, dfaire). (un point) rpte les dernires modifications

Rechercher et remplacer/motif recherche motif en allant vers la fin du documentn rpte la dernire recherche (next, suivant)N retourne au rsultat de la prcdente recherche effectue:%s/motif/motif2/g recherche le motif et la remplace par motif2

11.2. Helpful authentication exceptions

The following values allow network devices to access WEB sites without authentication process in order toconnect to the following services:

The following values allow client devices to access the Internet without authentication in order toconnect to the following services:

perform a test of Internet connection, Microsoft system update, TrendMicro and Clamav antivirus update, check Mozilla version and its modules, ...

Sites, IP addresses or URLs can be configured in the ACC or in the following file /usr/local/etc/alcasar-uamallowed:uamallowed="activation.sls.microsoft.com"uamallowed="www.msftncsi.com"uamallowed="crl.microsoft.com"uamallowed="download.microsoft.com"uamallowed="download.windowsupdate.com"uamallowed="go.microsoft.com"uamallowed="ntservicepack.microsoft.com"uamallowed="stats.update.microsoft.com"uamallowed="update.microsoft.com"uamallowed="update.microsoft.com.nsatc.net"uamallowed="pccreg.trendmicro.de"uamallowed="pmac.trendmicro.com"uamallowed="tis16-emea-p.activeupdate.trendmicro.com"uamallowed="update.nai.com"uamallowed="download.mozilla.org"

Domains can also be configured in the ACC or in the file /usr/local/etc/alcasar-uamdomain:uamdomain=".download.microsoft.com"uamdomain=".download.windowsupdate.com"uamdomain=".ds.download.windowsupdate.com"uamdomain=".microsoft.com"uamdomain=".update.microsoft.com"uamdomain=".update.microsoft.com.nsatc.net"uamdomain=".windowsupdate.com"uamdomain=".windowsupdate.microsoft.com"uamdomain=".trendmicro.com"uamdomain=".activeupdate.trendmicro.com"uamdomain=".akamaiedge.net"uamdomain=".akamaitechnologies.com"uamdomain=".clamav.net"

It is necessary to restart the chili service if these files are changed directly.


11.3. User sheet

ALCASAR is now deployed in your organization. ALCASAR is anetwork access controller, it means that when you will go on the Internet,the following login window will be displayed. (Both fields are casesensitive; "smith" and "Smith" are two different users).

When login is successful, this popup window appears. It allows you to logoutfrom ALCASAR. This window provides information on your accountpermissions (lease time, download limits, connection history, etc.)..

If this window is closed when you want to logout, just type "logout" in yourbrowser address bar.

If login fails, a message will give you more information: Expired account,maximum download volume reached, attempts to login outside the allocatedslot times, etc.

You can access your account details(login/logout, changeyour password, installation of the certificate in yourbrowser) by entering "ALCASAR" in your browseraddress bar.

The portal embeds a WEB flow antimalware and a website filtering to prevent unauthorized web browsing. Italso helps to know if there is a problem with the Internet connection (hardware failure or ISP network failure).The following pages are displayed:


1. Introduction2. Network settings2.1. ALCASAR settingsa) IP configurationb) DHCP server

2.2. Client devices settingsa) Client device settingb) Adding bookmarkc) Installing the ALCASAR security certificated) Network configuration in static mode (servers, printers, WIFI access points, etc.):e) Time synchronization

3. Managing users and their devices3.1. Network activity3.2. Creating groups3.3. Editing and removing a group3.4. Creating users3.5. Searching and editing users3.6. Importing usersa) From a user database backupb) From a text file (.txt)

3.7. Emptying the user database3.8. Authentication exceptionsa) To trusted sites or trusted domain namesb) To trusted IP addresses or trusted network IP addressesc) Allowing trusted client devices

3.9. Auto-registration via SMSa) Purpose, principle and prerequisite:b) enable the service:c) User interfaced) Accounts management [administration]e) Country filteringf) Error messages [administration]

4. Filtering4.1. Blacklist and whitelista) Updating the listb) Editing the blacklistc) Special blacklist filteringd) Whitelist

4.2. Protocol filtering

5. Access to Statistics5.1. Number of connections per user per day5.2. Connection status of users5.3. Daily use5.4. Global and detailed traffic5.5. Security Report

6. Backup6.1. Connection logs6.2. The users database

7. Advanced features7.1. Administration accounts management7.2. Secure administration across the Interneta) Broadband modem/router configurationb) administration of ALCASAR in text modec) Administration ALCASAR in GUI moded) Managing devices on the ALCASAR networke) Use of SSH tunnel with public / private key pair (public/private key)

7.3. How to display your logo ?7.4. Server certificatea) Install an official certificateb) Copy of a certificate on several ALCASAR server

7.5. Use of an external directory server (LDAP or AD)7.6. Integration in a complex architecture (AD, external DHCP, LDAP)a) Managing Windows DNSb) Using an External DHCP Server

7.7. Encryption of log files7.8. Managing multiple Internet connections (load balancing)7.9. Creating an ALCASAR dedicated PC7.10. Bypassing the portal

8. Shutdown, restart, update and reinstallation8.1. Shutdown and restart8.2. Operating system update8.3. ALCASAR minor updates8.4. ALCASAR major update or reinstallation

9. Troubleshooting9.1. Network connectivity9.2. Available disk space9.3. ALCASAR server services9.4. Client devices connection9.5. Connection to ALCASAR with a serial terminal9.6. Problems experienceda) On some sites, pictures are not displayedb) Navigation imp

Documents

Alcasar 2.9 Exploitation